They're trying to sell us a SOC security monitoring service, is it really necessary for our size?

Don't confuse endpoint protection with a SOC. A SOC parses logs and employs analysts. In setups with 20 devices like yours, the volume of meaningful logs to analyze daily is already very low. Just install modern endpoint software with automated blocking and quarantine capabilities, don't pour money into analysts every month.

We're a 35-person company; last year we bought into similar promises and signed a contract for 35,000 TL a month. In 6 months they generated 42 alerts total. 40 were false alarms, and the remaining 2 were our own developer entering the wrong password while testing a VPN. We saw zero benefit and walked away when the contract ended.

Do your NDAs or service contracts with clients require monitoring by an independent SOC? If you deal with large enterprise clients, they sometimes ask this on vendor assessment forms. If you're not under that kind of contractual pressure, why even keep this offer on the table?

we had a salesperson push us like that too. enabled 2fa closed server ports to the public, warned staff about phishing emails and that was that. 45k lira isn't money to throw away every month.

If you're looking for a middle ground, consider these three options: 1) Ask for an 8x5 package covering business hours instead of 24/7; the price usually drops by two-thirds, 2) Request incident response support on an on-demand, hourly retainer basis rather than a flat monthly fee, 3) Keep log retention inside your own cloud, strictly limited to legal compliance minimums.

Classic fear-mongering from cybersecurity firms. They act like international hacker syndicates are running coordinated attacks against a 20-person company every night. If your backups are solid and systems are patched, there's no need for this kind of spend.

Provided your company is not subject to statutory regulations or licensing mandates, performing a risk assessment in accordance with ISO 27001 standards is sufficient. If the identified risk level is low, strengthening preventive controls is recommended over engaging a full-scale monitoring center.

Reject the offer outright. Hook up alerts for suspicious logins and abnormal resource spikes directly from your cloud provider's console to your internal team chat. You'll catch the most critical warnings instantly without spending an extra dime.

This thread is archived.

I agree.

I've been dealing with this for a long time. Security isn't absolute; it's about making attacks not worth the effort.

Most incidents start with a leaked password, not a vulnerability. If you post the result here, it will help others too.

The discussion got scattered, let me summarize. Start with a small trial; don't commit to everything at once.

Hope this helps.

Let me summarize the topic, since several different answers were given. If it's your first time, start small; scaling comes later.

I'd appreciate it if you shared the outcome. An untested backup is not a backup.

If you have questions, write them; I'll answer as best I can.

Let me share what happened to me; it might be useful. The harder it is to reverse a decision, the slower you should make it.

Following.

I've been down this road, let me tell you. If 2FA is on, a stolen password alone is useless.

This is my opinion, I'm not claiming it's absolute truth.

I have an objection here. Hasty decisions become decisions you have to fix six months later.

Good luck with that.